What’s Vulnerable › Vulnerabilities

CVE-2024-47910

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-10-04 · updated 2026-06-17
• Weakness: CWE-284

Description

An issue was discovered in SonarSource SonarQube before 9.9.5 LTA and 10.x before 10.5. A SonarQube user with the Administrator role can modify an existing configuration of a GitHub integration to exfiltrate a pre-signed JWT.

Affected products

• SonarSource SonarQube: from 10.0 before 10.5; before 9.9.5lta — fixed in 10.5, 9.9.5lta

How to fix

Upgrade to a fixed version: SonarSource SonarQube 10.5, 9.9.5lta. Check the vendor advisory for mitigations.

References

• https://community.sonarsource.com/t/sonarqube-github-integration-information-leakage/126609
• https://sonarsource.atlassian.net/browse/SONAR-21795
• https://sonarsource.atlassian.net/browse/SONAR-21813

Get alerted when CVE-2024-47910 or the next vulnerability affects your stack